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DETAILED ACTION 

This Action is in regards to the Reply received on 05/25/2006. 

Response to Amendment 

1 . This action is responsive to the applicant's argument filed on 05/25/2006. 

By this amendment claims 1-3, 15, 20, 24, 26, and 37 are amended. No new matter has 
been added. 

Reconsideration of the previous rejection is herein submitted and allowance of 
the instant application are respectfully requested buy the applicants, is not granted 
because the application is not in condition for allowance as specified below. 

Claim Rejections - 35 USC §112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

The previous rejection of claims 1,15, 20, 24, and 37, under 35 U.S.C. 112, 
second paragraph, as being indefinite for failing to particularly point out and distinctly 
claim the subject matter which applicant regards as the invention, has been withdrawn 
based on subsequent amendment made by the applicants. 

The previous rejection of claims 21 and 22, under 35 U.S.C. 112, first paragraph, 
for failing to comply with the written description requirement have been withdrawn 
based on applicants' remarks made on the reply dated 05/25/2006. 
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Response to Arguments 

3. Applicant's arguments with respect to independent claims 1, 20, 24, 26 and 

37 have been carefully considered, but are not deemed fully persuasive. Furthermore, 
applicant's argument regarding previously rejected claims have also been fully 
considered and are not persuasive. Applicant's arguments are deemed moot in view of 
the following new ground of rejection as explained here below, 

The dependent claims stand rejected as articulated in the First Office Action 
and all objections not addressed in Applicant's response are herein reiterated. 

In response to Applicant's arguments, 37 CFR § 1 .1 1(c) requires applicant to 
"clearly point out the patentable novelty which he or she thinks the claims present in 
view of the state of the art disclosed by the references cited or the objections made. He 
or she must show the amendments avoid such references or objections." 

The Examiner maintains the rejection arguments presented in the previous Office 
Action as outlined below and the rejection is therefore sustained. New patent of Yu 
replaces the patent of Porras to address the applicant's main point of contention, that is: 
Claim 1 recites in part, determining a cumulative penalty count value associated with 
said sender identifier, wherein determining said cumulative penalty count value 
comprises assessing a penalty count value to said sender identifier for an undesirable 
activity performed by the sender" The Office Action correctly recites that Donaldson, 
does not specifically teach the details of a method wherein determining said cumulative 
penalty count value comprises assessing a penalty count value to said sender identifier 
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for an undesirable activity.'" Office Action page 6. However, the Office Action then 
implies that Porras teaches this element at column 1 A lines 27-40. Applicant disagrees 
with this characterization of the new Porras reference. Porras discloses certain 
techniques for identifying a data transfer as malicious, but does not teach or suggest 
"assessing a penalty count value to said sender identifier for an undesired activity, " as 
recited in claim 1 . 

However, it is the examiner's position that new patent of Yu discloses the details 
of this limitation in the claim as explained below. Suggestion to combine Donaldson 
with Yu is provided and a reasonable expectation of success is provided [see rejection 
of claims 1 below]. 

Examiner notes with delight that no new matter has been added and that the new 
claims are supported by the application as filed. However, applicant has failed in 
presenting claims and drawings that delineate the contours of this invention as 
compared to the cited prior art. Applicant has failed to clearly point out patentable 
novelty in view of the state of the art disclosed by the references cited that would 
overcome the 103(a) rejections applied against the claims, the rejection is therefore 
sustained. 

Claim Objections 

4. Claims 14-16, 18, 19, 31, 35, 36, 45-47, 49, and 50 are objected to as being 

dependent upon a rejected base claim, but would be allowable if rewritten in 
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independent form including all of the limitations of the base claim and any intervening 
claims. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 1-3, 5-10, 20-28, 29, 30, 32-34, and 37, 38, 40, and 41 are rejected 
under 35 U.S.C. 103(a) as being unpatentable over Donaldson et al (Donaldson), U.S. 
6,321 ,267 B1 in view of Yu, U.S. Patent No. 7,092,992 B1 . 

Regarding claim 1, Donaldson discloses the invention substantially as claimed. 
Donaldson teaches teach a method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender {column 2, lines 37-41; fig. 
1, items 1045-1048), said method comprising the steps of: 

Determining a sender identifier on the sender to provide a sender identifier 
{column 6, lines 14-20; column 14, lines 63-67; fig. 14, items 1401-1406)] 

determining a cumulative penalty count value associated with said sender 
identifier {column 23, lines 25-36; column 22, lines 25-33; fig. 16, items 1500-1518; note 
that the penalty count value here is the threshold number points or the matching count)] 

retrieving a system resource usage status associated with the communication 
device {column 6, lines 42-52)] and 

processing the incoming e-mail on the basis of said cumulative penalty count 
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value and said system resource usage status (column 22, lines 28-33; column 16, 12- 
64).; however, Donalson does not pecifically teach the details of a method "wherein 
determining said cumulative penalty count value comprises assessing a penalty count 
value to said sender identifier for an undesirable activity performed by the sender". 

In the same field of endeavor, Yu discloses (...In step 840, the contents of the e- 
mail message are analyzed. For example, the e-mail may contain hidden images that 
cause a cookie to be stored on the computer used by user 1 80 or that cause user data 
to be sent to a server that is not associated with user 180, e-mail service 100, or an 
authorized sender. Such hidden images may comprise, for example, definitions of GIF 
images having colors defined as transparent, etc. Identifying such hidden images 
results in an analytical determination by process 800' that the e-mail is unwanted by 
user 180. Also, the contents of the e-mail may be scanned for key words that relate to 
the e-mail resource to determine if the text included in the e-mail is likely related to the 
topic of mail list 190. In step 850, unwanted e-mail identifier 140 generates a score 
value based on the results of comparing the sender address to the authorized list of 
sender addresses and the results of analyzing the contents of the e-mail message. 
The score value represents the likelihood that user 180 will be interested in receiving 
the e-mail. If the value is high, then there is a strong likelihood that user 180 would 
want to receive the message, and thus the e-mail is probably a valid e-mail for mail list 
190. However, if the value is low, then it is likely that user 180 would not want to 
receive the message, and thus the e-mail is probably not valid for the mail list 190... 
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(Note that the score value represent the penalty count and that [see Yu t column 7, 
lines 59-67; column 8, lines 1-16]. 

Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Yu's teachings of 
determining penalty count value to said sender identifier for an undesirable activity 
performed by the sender with the teachings of Donaldson, for the purpose of "providing 
the user with the ability to preserve privacy and prevent unwanted or unauthorized use 
. . .and to protect unsolicited email or aharingof the anonymous address by otheres " as 
stated by Yu column 1. By this rationale claim 1 is rejected. 

Regarding claim 2: The combination of Donaldson-Yu teach the method of 
claim 1 wherein said step of Determining a sender identifier on the sender comprises 
the step of ascertaining an IP address for the sender (see Donalson; column 6, lines 14- 
20). 

Regarding claim 3: The combination of Donaldson-Yu teach the method of 
claim 1 wherein said step of Determining a sender identifier on the sender comprises 
the step of associating the sender with a peer IP address of the sender TCP connection 
(column 6, lines 42-52). 

Regarding claim 5: The combination of Donaldson-Yu teaches the method of 
claim 4 wherein said cumulative penalty count value comprises an activity penalty count 
charged to the sender for current undesirable sender activity and a time-dependent 
penalty count determined from previous undesirable sender activity (column 22, lines 
23-33; column 5, lines 59-67; column 6, lines 1-2; note that attempting to send a copy of 
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the message 100 times suggest that the penalty count dependent on previous 
undesirable sender's activity). 

Regarding claim 6: The combination of Donaldson-Yu teaches the method of 
claim 5 wherein said time-dependent penalty count comprises a zero value subsequent 
to a pre-established retention period {column 17, lines 59-64; note that if the result is 
zero, then the remote host matches the particular node filter). 

Regarding claim 7: The combination of Donaldson-Yu teaches the method of 
claim 5 wherein said time-dependent penalty count comprises a prior activity penalty 
count value reduced by a time-dependent decay factor {column 21, lines 12-56; note 
that the filter scans the node name of the remote host for certain sequences and adds 
or subtracts points). 

Regarding claim 8: The combination of Donaldson-Yu teaches the method of 
claim 1 wherein said undesirable activity comprises a member of the group consisting 
of: sending a large number of e-mails {column 1, lines 14-20), sending e-mails of 
relatively large sizes {column 1, lines 17-19), using a relatively large amount of TCP 
connection time {column 26, lines 1-11), and causing a TCP timeout {column 33, lines 
20-23; Note the appearance of the interrupted TCP connection). 

Regarding claim 9: The combination of Donaldson-Yu teaches the method of 
claim 1 wherein said system overall resource usage status is a function of a member of 
the group consisting of: the number of concurrent TCP connections being maintained 
{column 25, lines 59-64), the number of e-mail files in an incoming message queue, and 
the amount of disk space being utilized for an incoming message queue {column 5, 
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lines 52-58; Donaldson et al disclose a message store and its mail queue that keeps 
undelivered messaged for up to a week). 

Regarding claim 10: The combination of Donaldson-Yu teaches the method of 
claim 1 wherein said step of processing the incoming e-mail comprises the step of 
assigning an operating state to the communication device, said operating state being a 
function of said system overall resource usage status {column 16, lines 15-19; 
Donaldson et al disclose a proxy which deallocates resources and resets internal state 
variables). 

Regarding claim 20: The combination of Donaldson-Yu teaches a 
communication device for determining the disposition of incoming e-mail from a sender, 
said device comprising: 

a penalty count filter module (fig. 13, item 1401) having 

. means for identifying the sender (column 6, lines 14-20; column 14, lines 63-67)] 

means for assigning a penalty count to the sender, said penalty count being a 
function of previous undesirable activity associated with the sender [see Yu, column 7, 
lines 59-67; column 8, lines 1-16]] 

means for determining an overall resource usage value for said communication 
device in receiving e-mail (column 16, lines 12-19)] 

means for specifying an operating state for said penalty count filter module, said 
operating state being a function of said overall resource usage value (column 16, lines 
12-19)\ and 
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an accept/reject filter for disposing of the incoming e-mail on the basis of said 
sender penalty count and said operating state (column 3, lines 43-45). 

Regarding claim 21 : The combination of Donaldson-Yu teaches the method of 
claim 20 wherein 

said means for identifying the sender includes means for obtaining at least one of a 
Domain Name Service verification (column 12, lines 45-49) and a peer IP address of the 
sender TCP connection (fig. 14, item 1404; fig. 13, item 1470). 

Regarding claim 22: The combination of Donaldson-Yu teaches the method of 
claim 20 wherein said undesirable activity comprises a member of the group consisting 
of: 

sending a large number of e-mails (column 1, lines 14-20), sending e-mails of 
relatively large sizes (column 1, lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-11), and causing a TCP timeout (column 33, lines 
20-23; Note the occurrence of the interrupted TCP connection). 

Regarding claim 23: The combination of Donaldson-Yu teaches the method of 
claim 20 wherein said system resource usage value is a function of a member of the 
group consisting of: the number of concurrent TCP connections being maintained 
(column 25, lines 59-64), the number of e-mail files in an incoming message queue, and 
the amount of disk space being utilized for an incoming message queue (column 5, 
lines 52-58; Donaldson et al disclose a message store and its mail queue that keeps 
undelivered messaged for up to a week). 
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Regarding claim 24: The combination of Donaldson-Yu teaches a 
communication device for determining the disposition of incoming e-mail from a sender, 
said device comprising: 

a sender penalty count data structure for storing a current penalty count value 
associated with the sender , wherein said current penalty count value is based at least 
in part on previous undesirable activity performed by the sender(column 23, lines 25-36; 
fig. 16, items 1500-1518; note that the data structure is represented by table 4 in 
column 23 and that matching count represents the penalty count); 

a system resource usage status file for storing a current usage status value for 
device e-mail processing resources (column 17, lines 27-48; note that the system 
resource becomes unavailable for email processing once the proxy determines that the 
remote network has been placed in a blacklisted database)] and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value [see Yu, column 7, lines 59-67; column 8, lines 1-16]. 

Regarding claim 25: The combination of Donaldson-Yu teaches a method claim 
24 wherein said sender penalty count data structure includes an entry comprising a 
member of the group consisting of: 

a sender identification value {column 22, lines 40-44), 

a cumulative penalty count value (column 22, lines 46-49) } 

a cumulative e-mail count (column 32, lines 41-45; note that the number of 
recipient here represents the number of emails), 

a total e-mail size (column 32, lines 45-48), 
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a total TCP connection time {column 26, lines 9-11), and 
a timestamp value {column 4, line 27). 

Regarding claim 26: The combination of Donaldson-Yu teaches a method 
suitable for use in a communication device for determining the disposition of incoming 
e-mail from a sender, said method comprising the steps of: 

identifying the e-mail sender by determining a sender IP address {column 6, lines 

14-24)] 

obtaining a previous sender penalty count value calculated for said sender IP 
address {column 22, lines 40-49; note that the matching mechanism is used here as the 
penalty count and that the 32-bit address for the remote host is used to calculate the IP 
address of its 20 neighbors), wherein the said previous sender penalty count value is 
based at lest oin part on previous undesirable activity performed by the sender; and 

accepting or rejecting the incoming e-mail based on said sender penalty count 
value {column 3, lines 43-45) and said usage status [see Yu, column 7, lines 59-67; 
column 8, lines 1-16]. 

Regarding claim 27: The combination of Donaldson-Yu teaches the method of 
claim 26 further comprising the steps of: 

maintaining a behavior trace table entry for the e-mail sender {column 21-22, 
table 3); and 

determining said previous sender penalty count from said behavior trace table 
{column 21-22, table 3, offset value). 
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Regarding claim 28: The combination of Donaldson-Yu teaches the method of 
claim 27 further comprising the step of updating sender behavior values in said trace 
table entry in response to receipt of a sender e-mail {column 17, lines 65-67; column 
18, lines 1-7; fig. 14, item 1408; note that if the sender's IP address matches an entry in 
the blacklist database, the proxy server issues an error reply to the remote host, closes 
the connection, logs the rejected connection, and exits without any email being 
transferred). 

Regarding claim 29: The combination of Donaldson-Yu discloses the method of 
claim 28 wherein said sender behavior values include o a member of the group consisting 
of: the number of e-mails, the total size of e-mails, and total time of TCP connection 
time (see Doaldson; column 32, lines 41-47; column 14, lines 43-47),. 

Regarding claim 30: The combination of Dongldson-Yu teaches the method of 
claim 28 wherein said step of updating sender behavior values comprises the steps of: 

reducing said behavior trace table value by a time-dependent decay factor 
{column 21, lines 45-67; column 21, table 3; the offset value has a decay factor +1)\ and 

adding a current behavior trace table value to said corresponding reduced 

behavior trace table value {column 21, lines 45-67; column 21, table 3). 

Regarding claim 32: The combination of Donaldson-Yu teaches the method of 
claim 26 wherein said sender penalty count value is determined from undesirable 
sender activity occurring over a pre-established retention period {column 5, lines 52-58; 
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note that the relay host will usually keep undelivered messages in its queue for up to a 
week). 

Regarding claim 33: The combination of Donaldson-Yu teaches the method of 
claim 32 wherein said undesirable activity comprises a member of the group consisting 
of: 

sending a large number of e-mails (column 1, lines 14-20), sending e-mails of 
relatively large sizes (column 1, lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-11), and causing a TCP timeout (column 5, line 52- 
54; column 33, lines 20-23; note the occurrence of the interrupted TCP connection). 

Regarding claim 34: The combination of Donaldson-Yu teaches the method of 
claim 26 further comprising the step of updating said previous sender penalty count 
value (column 21, lines 12-15). 

Regarding claim 37: The combination of Donaldson-Yu teaches the method for 
by a communication device for determining the disposition of incoming e-mail from a 
sender (column 2, lines 37-41; fig. 1, items 1045-1048), said method comprising steps 
of: 

establishing an identity of the sender (column 6, lines 14-20; column 14, lines 63- 
67; fig. 14, items 1401-1406)] 

determining a cumulative penalty count value associated with said identity, wherein 
said cumulative penalty count is based at least in part previous undesirable activity 
performed by the sender[see Yu, column 7, lines 59-67; column 8, lines 1-16], 
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retrieving a system overall resource usage status associated with the 
communication device (column 6, lines 42-52); and 

processing the incoming e-mail based on the cumulative penalty count value and 
the system overall resource usage status {column 22, lines 28-33; column 16, 12-19). 

Regarding claim 38: The combination of Donaldson-Yu teaches the method of 
claim 37, wherein said step of establishing the identity of the sender comprises the step 
of ascertaining an IP address of the sender (column 6, lines 14-20). 

Regarding claim 40: The combination of Donaldson-Yu teaches the method of 
claim 37, wherein said cumulative penalty count value comprises a prior penalty count 
value reduced by a time-dependent decay factor (column 21, lines 12-56; note that the 
filter scans the node name of the remote host for certain sequences and adds or 
subtracts points). 

Regarding claim 41 : The combination of Donaldson-Yu teaches the method of 
claim 37 wherein said step of processing the incoming e-mail comprises the step of 
assigning an operating state to the communication device, said operating state being a 
function of said system time-dependent resource usage status (column 16, lines 12-19). 

7. Claims 11-13, 17, 42-44, and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Donaldson and Yu, in view of Munger et al (Munger), U.S. 6,502,135 
B1). 

Regarding claims 11 and 42, the combination Donaldson-Yu teaches the 
invention substantially as claimed. Donaldson discloses a method, wherein said 
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operating state is a member of the group consisting of a normal operating state (see 
Donaldson; column 16, lines 15-19), and a selective-rejection operating state (see 
Donaldson; column 14, lines 63-67, column 15, lines 1-2), but fails to specifically 
disclose a random-rejection operating state. 

In the same field of endeavor, Munger discloses (..a random sync values that 
feed a random number generator, to prevent spooling attacks using a hashing 
technique of a time stamp or sequence number, and to establish the concept of future 
and past states while validating or rejecting the incoming packets in a network device... ) 
[see Munger, column 26, lines 14-45]. 

Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Munger' s teachings of the 
random rejection of incoming packets, with the teachings of Donaldson, for the purpose 
of " getting advantage of quickly rejecting packets from unauthorized users such as 
hacker computer 3105..." as stated by Munger in lines 25-36 of column 45. By this 
rationale claims 11 and 42 are rejected. 

Regarding claims 12 and 43, the combinationlDonaldson-Yu-Munger teaches a 
method wherein, for said selective-rejeqtion state, if said cumulative penalty count value 
has a zero value, said step of processing the incoming e-mail comprises the step of 
accepting the incoming e-mail [see column 17, lines 38-67]. The same motivation that 
was utilized in the combination of claims 1 1 and 42, applies equally as well to claim 12 
and 43 [see Munger, column 45, lines 25-36]. By this rationale claims 12 and 43 are 
rejected. 
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Regarding claims 13 and 44: the combination Donaldson-Yu-Munger teaches a 
method wherein, for said selective-rejection state, if said cumulative penalty count value 
has a nonzero value [see Donaldson, column 22, lines 34-62], said step of processing 
the incoming e-mail comprises the steps of: specifying a rejection factor; generating a 
random number; and randomly rejecting the incoming 1 e-mail on the basis of said 
rejection factor and said random number [see Munger, column 28, lines 5-67, column 
29, lines 1-64]. The same motivation that was utilized in the combination of claims 1 1 
and 42, applies equally as well to claim 13 and 44 [see Munger, column 45, lines 25- 
36], By this rationale claims 13 and 44 are rejected. ° 

Regarding claims 17 and 48: the combination Donaldson-Yu-Munger teaches 
a method wherein if said cumulative penalty count value has a zero value [see 
Donaldson, column 17, lines 59-67], said step of processing the incoming e-mail 
comprises the steps of: deriving an overall resource usage factor; generating a random 
number; and randomly rejecting the incoming e-mail on the basis of said overall 
resource usage factor, said random number, and said cumulative penalty count value 
[see Munger, column 28, lines 5-67, column 29, lines 1-64]. The same motivation that 
was utilized in the combination of claims 1 1 and 42, applies equally as well to claim 17 
and 48 [see Munger, column 45, lines 25-36]. By this rationale claims 17 and 48 are 
rejected. 
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Conclusion 

8. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE NON-FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

Any inquiry concerning this communication or earlier communications from 
examiner should be directed to Jude Jean-Gilles whose telephone number is (571) 272- 
3914. The examiner can normally be reached on Monday-Thursday and every other 
Friday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley, can be reached on (571) 272-3923. The fax phone number for 
the organization where this application or proceeding is assigned is (703) 305-3719. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Jude Jean-Gilles 
Patent Examiner 
Art Unit 2143 

JJG @ 

August 15, 2006 




